Skip to main content
Share Your Experience: Take the 2024 Developer Survey
25 votes
Accepted

How does NAT reflection (NAT loopback) work?

For a NAT to work properly both the packets from client to server and the packets from server to client must pass through the NAT. Note that the NAT table in iptables is only used for the first ...
plugwash's user avatar
  • 4,352
6 votes
Accepted

Port forwarding & NAT with nftables

You are not translating the port number. When the external connection is to port 1234, this is not a problem. But when it is to 4321, the dnat passes through to port 4321 on the internal server, not ...
Steve Brandli's user avatar
5 votes

How to override dns server in nat gateway (iptables)

not --sport 53, use --dport 53
Ipor Sircer's user avatar
  • 14.6k
5 votes

Linux: Connect to two different networks with same ip range

Firstly, I don't have the option to test this really, so I'm bound to have some detail wrong, but essentially you'll need special routing to make some packets for address 10.5.5.9 to go out wlan1 and ...
Ralph Rönnquist's user avatar
5 votes
Accepted

Access VM via static IP (NAT?)

You've to create a bridged network between the Host and VM. The configuration varies on Hypervisor vendor. In case you're using Oracle Virtual Box Open Oracle VM VirtualBox Manager, select the VM ...
Abhik Bose's user avatar
  • 2,118
5 votes

SSH connections frequently disconnected when using a mobile hotspot for internet access

There are three main reasons your ssh sessions (or other persistent connections) may be disrupted when using cellphone towers/a mobile hotspot for internet access: Your IP address is changing. This ...
TiredSquirrel's user avatar
4 votes

Using Linux as router with nftables - masquerade not forwarding reply back

The nftables wiki states: "[...] you have to register the prerouting/postrouting chains even if you have no rules there since these chain will invoke the NAT engine for the packets coming in the ...
Gongjin's user avatar
  • 41
4 votes
Accepted

Router with nftables doesn't work well

The firewall rules did not cause the problem. Instead, it's due to the MTU difference in "plain" Ethernet and PPPoE. Since PPP header takes up (at least) 8 bytes, and the usual MTU of ...
Tom Yan's user avatar
  • 803
4 votes

Can a NAT router run out of ports?

If a router doing NAT uses an ephemeral port for each connection made to the internet on behalf of the hosts on the internal network, does this mean that it is possible for the router to run out of ...
Chris Davies's user avatar
3 votes
Accepted

Common DNS for virtual machines - with iptables/netfilter

You have to use sysctl -w net.ipv4.conf.XXX.route_localnet=1 as you did, but probably on the virtual Ethernet interface. This allow the kernel to keep martin packets. Also keep in mind that locally ...
Bertrand SCHITS's user avatar
3 votes

How does iptables MASQUERADE work on the incoming side?

In iptables only the first packet of a connection hits the chains in the nat table (this is different from chains in other tables). Packets related to an existing connection are translated ...
plugwash's user avatar
  • 4,352
3 votes

GlusterFS how to failover (smartly) if a mounted Server is failed?

OpenUserX03's answer is not quite accurate. When a client connects to a Gluster server node, it receives information about all the nodes. After that, it starts communicating with multiple nodes ...
Yuhao Zhang's user avatar
3 votes

Networking issue with Virtualbox

Network connectivity to your VM - assuming of course that it has a properly configured service to connect to - depends on what network type you've chosen in the VM settings. 1) NAT - this does what ...
ivanivan's user avatar
  • 4,985
3 votes

iptables/netfilter: "nf_nat_ftp" is not working well with recent Linux kernels

I already answered it at superuser.com Basically newer kernels ( >= 4.7 ) are deprecating the automatic helper module's port assignment in favor of explicit rules. Short fix to get the old behaviour:...
A.B's user avatar
  • 37k
3 votes

Implicit Inverses for iptables NAT Rules

Does iptables implicitly and automatically add the reverse/inverse rules for every NAT rule that is added explicitly? Not exactly Your first two quotes are correct, the third is confused ramblings ...
plugwash's user avatar
  • 4,352
3 votes
Accepted

How To Configure a noip on linux, if I has Double NAT ISP Like JioFi?

Your ISP does NAT between its public IP (157.50.xx.xx) and the ISP internal private IP (10.89.xx.xx). Unless you can convince your ISP (by switching to the appropriate plan, usually for business, that ...
dirkt's user avatar
  • 32.5k
3 votes
Accepted

Iptables NAT / Kernel IP forwarding limited to ~10Mbit

The Banana R1/Lamobo R1 while an interesting piece of hardware has too many shortcomings. Firstly, the "switch" internal interface bandwidth is shared. A theoretical 1GBps tops for all shared 5 ports;...
Rui F Ribeiro's user avatar
3 votes

How can I access a virtual machine running on a remote machine directly?

Use ProxyJump or ProxyCommand. Add this to your ~/.ssh/config: Host vmhost User t Hostname 192.168.1.198 Host vm Hostname 192.168.122.169 User t ProxyJump vmhost or for older ...
pLumo's user avatar
  • 22.6k
3 votes
Accepted

nat configuration for qemu-kvm guest and host networks

The MASQUERADE rule happens at POSTROUTING: that is after a routing decision was already made and a destination interface was already chosen. To communicate with outside, the host will use 192.168.117....
A.B's user avatar
  • 37k
3 votes
Accepted

How to share an IPv6 connection to the whole LAN?

Sure, if your IPv6 connection gives you a prefix that is large enough for all the devices in the LAN (i.e. a prefix number smaller than /128, ideally /64 or less). First, enable IPv6 forwarding by ...
telcoM's user avatar
  • 98.1k
3 votes
Accepted

How to enable internet access for nixos container with private network

It worked by running iptables -t nat -A POSTROUTING -o wlp2s0f0u7 -j MASQUERADE. Here is the output iptable rules: sudo iptables -L -v -t nat Chain PREROUTING (policy ACCEPT 154 packets, 22783 bytes)...
Chris Stryczynski's user avatar
3 votes
Accepted

iptables rules to forward tftp via NAT

Since Linux 4.7 in 2016, the conntrack automatic helper assignment was disabled by default (after having years of warning about this in kernel messages): Four years ago we introduced a new sysctl ...
A.B's user avatar
  • 37k
3 votes
Accepted

iptables - Drop NAT rules based on rule/name, NOT rule number

Given any rule with -I (insert) or -A (append), you can repeat the rule definition with -D to delete it. For your particular example, this will delete the first matching rule in the OUTPUT chain for ...
Chris Davies's user avatar
3 votes
Accepted

How to configure port forwarding with nftables for a Minecraft server on Raspberry Pi?

As a reminder, nftables (just like iptables) sees only the first packet of a flow to be NAT-ed. When it comes to doing NAT, every other packet in the same flow will be handled directly by Netfilter/...
A.B's user avatar
  • 37k
3 votes
Accepted

NAT router with 2 external WAN IPs A+B and multiple internal LANs: Let 1 LAN use external IP address B, all other A

Use SNAT instead of MASQUERADE ... in order to choose something else than the default. Instead of using MASQUERADE for the generic case (all other LANs), add a SNAT exception for LAN3 clients. This ...
A.B's user avatar
  • 37k
2 votes

1:1 Stateless NAT kernel version 3.16 or later using TC

I think you interchanged the src and dst matches. I've got for now: #tc qdisc del dev eth0 ingress #tc qdisc del dev eth0 root tc qdisc add dev eth0 root handle 1: htb tc qdisc add dev eth0 ingress ...
powpow's user avatar
  • 31
2 votes
Accepted

iptables DNAT: 'No chain/target/match by that name'

The problem was a missing module XT_TCPUDP There is the full list of dynamic loaded module for my command : xt_nat 1527 1 - Live 0xbf12f000 xt_tcpudp 1961 1 - Live 0xbf12b000 iptable_nat 2396 1 - ...
Manticore's user avatar
  • 141
2 votes
Accepted

Trying to SSH overseas

Well you would need him to port forward port 22 from his computer and have him be running sshd if you want to do it the simple way. On the other hand, you can do the dirty work and have him do a port ...
John Leuenhagen's user avatar
2 votes

NAT Routing VPN connection to Local Network

(I'm assuming you are using an L3 VPN.) The clean (NAT-less) way to do this is to give an IP of your LAN to your OpenVPN client. Let's say your LAN is 192.168.0.0/24, you can statically allocate one ...
ysdx's user avatar
  • 1,883

Only top scored, non community-wiki answers of a minimum length are eligible